Analysis
-
max time kernel
149s -
max time network
195s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
23-08-2021 09:56
Static task
static1
Behavioral task
behavioral1
Sample
DHL (SCAN) Shipment Notification.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
DHL (SCAN) Shipment Notification.exe
Resource
win10v20210410
General
-
Target
DHL (SCAN) Shipment Notification.exe
-
Size
1.0MB
-
MD5
90d18e14ba0ddee3dd22598c8435c109
-
SHA1
b8b473aa7cefe46e934bde3a5c89f7f96f197ed1
-
SHA256
bf0cc4fd655e77d8b634ad0f7de607e8bda88034910511e120dafc86d96fd8df
-
SHA512
10fe71f49c94f8b263fc113ad5ad3bb15067644941db57ea386294b34f3e27bd77bc049835fd07239495c18cc02dab8ea8c1f129ef1875603a8950c1acfc3d5e
Malware Config
Extracted
remcos
LAS LAS
goddywin.freedynamicdns.net:4108
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-YZ590Y
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
DHL (SCAN) Shipment Notification.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pyhbarq = "C:\\Users\\Public\\Libraries\\qrabhyP.url" DHL (SCAN) Shipment Notification.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
DHL (SCAN) Shipment Notification.exedescription pid process target process PID 368 wrote to memory of 852 368 DHL (SCAN) Shipment Notification.exe logagent.exe PID 368 wrote to memory of 852 368 DHL (SCAN) Shipment Notification.exe logagent.exe PID 368 wrote to memory of 852 368 DHL (SCAN) Shipment Notification.exe logagent.exe PID 368 wrote to memory of 852 368 DHL (SCAN) Shipment Notification.exe logagent.exe PID 368 wrote to memory of 852 368 DHL (SCAN) Shipment Notification.exe logagent.exe PID 368 wrote to memory of 852 368 DHL (SCAN) Shipment Notification.exe logagent.exe PID 368 wrote to memory of 852 368 DHL (SCAN) Shipment Notification.exe logagent.exe PID 368 wrote to memory of 852 368 DHL (SCAN) Shipment Notification.exe logagent.exe PID 368 wrote to memory of 852 368 DHL (SCAN) Shipment Notification.exe logagent.exe PID 368 wrote to memory of 852 368 DHL (SCAN) Shipment Notification.exe logagent.exe PID 368 wrote to memory of 852 368 DHL (SCAN) Shipment Notification.exe logagent.exe PID 368 wrote to memory of 852 368 DHL (SCAN) Shipment Notification.exe logagent.exe PID 368 wrote to memory of 852 368 DHL (SCAN) Shipment Notification.exe logagent.exe PID 368 wrote to memory of 852 368 DHL (SCAN) Shipment Notification.exe logagent.exe PID 368 wrote to memory of 852 368 DHL (SCAN) Shipment Notification.exe logagent.exe PID 368 wrote to memory of 852 368 DHL (SCAN) Shipment Notification.exe logagent.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL (SCAN) Shipment Notification.exe"C:\Users\Admin\AppData\Local\Temp\DHL (SCAN) Shipment Notification.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/368-59-0x00000000769B1000-0x00000000769B3000-memory.dmpFilesize
8KB
-
memory/368-60-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/852-61-0x0000000000000000-mapping.dmp
-
memory/852-64-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/852-63-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/852-66-0x0000000010590000-0x000000001060D000-memory.dmpFilesize
500KB
-
memory/852-65-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/852-67-0x0000000000280000-0x00000000002FA000-memory.dmpFilesize
488KB